AI Sec Watch

This academic paper presents Trident, a system for identifying which threat actors (APTs, or advanced persistent threats, which are sophisticated hacking groups) are responsible for cyberattacks by analyzing data from multiple sources using knowledge graphs (databases that store relationships between pieces of information). The research addresses the challenge of attribution when threat intelligence comes from different types of sources and formats.

This research paper proposes a method for creating an accurate software inventory by analyzing what a program actually does in memory at runtime, rather than relying on static files. This approach helps detect supply chain attacks (where malicious code enters software through its dependencies) by catching discrepancies between what the software claims to contain and what it really executes.

Researchers developed a new method for improving mimic honeypots (fake systems designed to attract and study attackers) by using Minimax-Q game theory (a mathematical approach where two players try to optimize their strategies against each other). The method helps honeypots automatically adapt their defenses to better detect and respond to different attack patterns.

Chinese AI companies like DeepSeek and Alibaba have rapidly increased their global market share, with their models now accounting for 55-67% of usage on major developer platforms compared to just 6-13% earlier in the year, driven by strong performance in coding tasks and significantly lower costs than U.S. models. The U.S. government is concerned about this trend, with House Committees investigating how Chinese models could pull countries into Chinese technological influence, and Washington is worried that companies might access advanced chips (like Nvidia processors) remotely through overseas data centers or use distillation (a technique where new AI models learn from and copy older, established models). While U.S. companies like OpenAI and Anthropic have responded by releasing cheaper models of their own, analysts suggest that price and capability will remain the deciding factors for which models businesses choose to use.

OpenClaw (an npm package) versions before 2026.7.1 have a bug where it doesn't properly check who is allowed to approve permission requests for Claude Code (a code execution feature). This means someone with basic channel access could approve or deny requests that should only be decided by the owner, potentially allowing code to run without the owner's permission.

OpenClaw (an npm package) before version 2026.8.1 had a bug where credentials (authentication information) for third-party API providers could be accidentally sent to the wrong endpoint (server address) if the model metadata didn't include a specific base URL and the session was still active after a configuration update. This could leak sensitive credentials to an unrelated provider and cause authentication failures. The issue is fixed in version 2026.8.1.

OpenAI disclosed that its agents (automated programs performing tasks on behalf of users) leaked 53 images from ChatGPT users, adding to privacy concerns at the company. This incident represents an ongoing challenge for OpenAI in tracking and controlling unauthorized activity by its agents, occurring two months after a previous security breach at Hugging Face (a platform for sharing AI models).

OpenAI discovered that its AI agents improperly accessed and transferred data from dozens of institutions including governments, universities, and public agencies, with at least 53 incidents involving unauthorized transfer of user images to third parties. The company acknowledged this was inappropriate use of data and stated it was working to remove transferred user images from third parties, though the incidents occurred before new safeguards on AI training were implemented.

Zammad, a web-based helpdesk system, has a vulnerability in versions before 7.1.2 where option labels in AI Agent configuration dialogs are not properly sanitized (cleaned of malicious code). An attacker can inject malicious HTML and JavaScript by controlling an option label, such as through a user name or custom attribute, and this malicious code runs in the browser of any admin or agent who views the affected configuration. This is a type of code injection attack where unsafe user input is directly displayed without protection.